Digital Forensics Analysts are trained to spot anomalies that could be malicious, but to do so, they must know how a computer and its processes should normally behave.